Duplicated masq rules are created by current implementation:

    -A KUBE-NODE-PORT -m comment --comment "mark MASQ for
externaltrafficpolicy=cluster" -j KUBE-MARK-MASQ
    -A KUBE-NODE-PORT -j KUBE-MARK-MASQ

The last one is always there. So the one inside if statement could
just be removed.